CVE-2025-55099 Overview
CVE-2025-55099 is an out-of-bounds read vulnerability in Eclipse Foundation ThreadX USBX before version 6.4.3. USBX is the USB support module for the ThreadX real-time operating system. The flaw resides in the _ux_host_class_audio_alternate_setting_locate() function, which parses USB audio class descriptors. When the function processes a descriptor containing attacker-controlled frequency fields, it can read memory beyond the intended buffer boundary. Exploitation requires physical access to attach a malicious USB device to a vulnerable host. The issue is tracked under [CWE-125: Out-of-bounds Read].
Critical Impact
A malicious USB device can trigger an out-of-bounds read in the USBX audio host class driver, potentially disclosing adjacent memory contents on embedded ThreadX systems.
Affected Products
- Eclipse ThreadX USBX versions prior to 6.4.3
- Embedded devices and IoT firmware built on ThreadX with the USBX host audio class enabled
- Systems exposing USB host ports that accept untrusted audio devices
Discovery Timeline
- 2025-10-17 - CVE-2025-55099 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55099
Vulnerability Analysis
The vulnerability affects the USB audio host class driver in Eclipse ThreadX USBX. USBX implements the host-side USB stack for the ThreadX RTOS and supports enumeration of standard USB device classes, including audio. During enumeration, the host reads class-specific descriptors from the attached device and iterates over alternate settings to select a compatible audio format.
The _ux_host_class_audio_alternate_setting_locate() routine walks through frequency fields supplied by the connected device. Because the parser trusts the device-provided frequency count and structure, a crafted descriptor can cause the routine to read past the end of the descriptor buffer. The out-of-bounds access can leak adjacent heap or stack memory into subsequent processing logic.
Exploitation is bounded to physical attack scenarios. An adversary must connect a rogue or reprogrammed USB peripheral to a target device running vulnerable firmware. The impact is limited to a partial loss of integrity in host-side parsing state, without a direct path to code execution.
Root Cause
The root cause is missing bounds validation on attacker-controlled length and frequency fields inside USB audio class descriptors. The parser assumes that descriptor-declared sizes match the actual buffer allocation. When these values are inflated or malformed, the loop indexing inside _ux_host_class_audio_alternate_setting_locate() dereferences memory outside the descriptor buffer.
Attack Vector
The attack vector is physical. An adversary crafts a USB audio device that returns malicious class-specific descriptors during enumeration. When the vulnerable ThreadX USBX host requests the audio alternate settings, the parser reads out of bounds. Refer to the Eclipse ThreadX USBX Security Advisory GHSA-93mv-fcpr-9488 for the technical description and fix commits.
No public proof-of-concept exploit is available. See the vendor advisory for the descriptor structure and the patched parsing routine.
Detection Methods for CVE-2025-55099
Indicators of Compromise
- Unexpected USB device enumeration events on ThreadX-based endpoints, particularly devices advertising the USB Audio class
- Firmware log entries or crash dumps referencing _ux_host_class_audio_alternate_setting_locate or malformed audio descriptors
- USB devices repeatedly disconnecting and reconnecting after audio descriptor parsing
Detection Strategies
- Inventory firmware versions across embedded and IoT fleets to identify USBX builds older than 6.4.3
- Enable verbose USBX host stack logging in development or lab units to capture descriptor parsing anomalies
- Correlate physical access events, such as USB insertions on kiosks or medical devices, with device reboots or watchdog resets
Monitoring Recommendations
- Restrict USB host port exposure on production ThreadX devices to authorized peripherals only
- Monitor field-deployed devices for firmware crash telemetry that references audio class enumeration paths
- Track vendor advisories from the Eclipse ThreadX project for follow-up USBX patches
How to Mitigate CVE-2025-55099
Immediate Actions Required
- Upgrade Eclipse ThreadX USBX to version 6.4.3 or later and rebuild affected firmware images
- Rebuild and redeploy all downstream firmware that statically links against vulnerable USBX sources
- Disable the USB host audio class driver in firmware builds that do not require audio device support
Patch Information
Eclipse Foundation addressed the issue in USBX 6.4.3 by adding bounds validation to _ux_host_class_audio_alternate_setting_locate(). Details are published in the GitHub Security Advisory GHSA-93mv-fcpr-9488. Vendors integrating USBX must pull the fixed release and issue firmware updates to affected products.
Workarounds
- Physically block or disable unused USB host ports on deployed devices
- Enforce port-locking, tamper-evident enclosures, or USB whitelisting where hardware supports it
- Remove the audio host class from the USBX build configuration if the product does not require it
# Configuration example: exclude the USB host audio class from a USBX build
# Remove or comment out the audio host class source files in the build system,
# for example in a CMake configuration:
# set(UX_HOST_CLASSES ux_host_class_hub ux_host_class_hid) # audio removed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
